CVE-2025-8546

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-8546
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8546.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-8546
Published
2025-08-05T05:02:06.125Z
Modified
2026-08-27T09:37:44.777467Z
Severity
  • 5.5 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P CVSS Calculator
Summary
atjiu pybbs Verification Code login Captcha
Details

A vulnerability, which was classified as problematic, was found in atjiu pybbs up to 6.0.0. This affects the function adminlogin/login of the component Verification Code Handler. The manipulation leads to guessable captcha. It is possible to initiate the attack remotely. The exploit has been disclosed to the public and may be used. The patch is named ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf. It is recommended to apply a patch to fix this issue.

Database specific 
{
    "cwe_ids": [
        "CWE-287",
        "CWE-804"
    ],
    "cna_assigner": "VulDB",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/8xxx/CVE-2025-8546.json"
}
References

Affected packages

Git / github.com/atjiu/pybbs

Affected ranges

Type
GIT
Repo
https://github.com/atjiu/pybbs
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:pybbs_project:pybbs:*:*:*:*:*:*:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "last_affected": "6.0.0"
        }
    ]
}

Affected versions

6.*
6.0
jfinalbbs2.*
jfinalbbs2.0
jfinalbbs2.1
jfinalbbs2.2
pybbs-4.*
pybbs-4.0-beta
pybbs2.*
pybbs2.5
pybbs2.5-lastest
pybbs2.6
pybbs4.*
pybbs4.0-release
v5.*
v5.0
v5.1.0
v5.2.0
v5.2.1
v6.*
v6.0.0

Database specific

vanir_signatures_modified 
"2026-08-27T09:37:44Z"
source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-8546.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 785.0,
            "function_hash": "276743334007744017902053742324071721802"
        },
        "id": "CVE-2025-8546-14b70833",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "function": "mobile_login",
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 710.0,
            "function_hash": "135191518287035039097528222664422836116"
        },
        "id": "CVE-2025-8546-299b1c67",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "function": "login",
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 551.0,
            "function_hash": "46327806450676146831567952480689153304"
        },
        "id": "CVE-2025-8546-49b8b211",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "function": "sms_code",
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "126527644860276446337381431592199952523",
                "273332153779206055292416274820885089374",
                "38012844428037570167033565766038827976",
                "191450388573280106713810687221831097816"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8546-5aa743a6",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/admin/IndexAdminController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1241.0,
            "function_hash": "60251454109088619925195501129293701462"
        },
        "id": "CVE-2025-8546-6aba916d",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "function": "adminlogin",
            "file": "src/main/java/co/yiiu/pybbs/controller/admin/IndexAdminController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Line",
        "signature_version": "v1",
        "digest": {
            "line_hashes": [
                "328445987428086373017268624733112158001",
                "109784412480779051337101059306053359340",
                "241183476973406150198480825181775737780",
                "86925429786499811427571154861111471647",
                "226278739576943100060488722188727408412",
                "37254563766456208976450029161654515289",
                "241183476973406150198480825181775737780",
                "86925429786499811427571154861111471647",
                "337918087967121183035039124740189262223",
                "276414785252259904576030703926613690877",
                "330933201389344601391100972082813697836",
                "176031941788024583912373069464867901678",
                "121223203452740804777616182453163328966",
                "260888233190188414777836060477734171937",
                "241183476973406150198480825181775737780",
                "176031941788024583912373069464867901678"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2025-8546-9ee7cb75",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    },
    {
        "deprecated": false,
        "signature_type": "Function",
        "signature_version": "v1",
        "digest": {
            "length": 1090.0,
            "function_hash": "67677807524966652656517846223949961432"
        },
        "id": "CVE-2025-8546-e0326531",
        "source": "https://github.com/atjiu/pybbs/commit/ecaf8d46944fd03e3c4ea05698f8acf0aaa570cf",
        "target": {
            "function": "register",
            "file": "src/main/java/co/yiiu/pybbs/controller/api/IndexApiController.java"
        }
    }
]